Critical Denial of Service Vulnerability in MariaDB - CVE-2018-2622
Summary
ALPINE-CVE-2018-2622: Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Affects mariadb versions < 10.1.32-r0. Fixed in 10.1.32-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MariaDB is an open-source relational database management system that is widely used for web applications and data storage. It is a fork of MySQL and offers enhanced features and performance improvements. The vulnerability CVE-2018-2622 affects multiple versions of MariaDB, making it susceptible to denial of service attacks, which can disrupt database availability and impact applications relying on it.
Vulnerability Detail
CVE-2018-2622 is a vulnerability in the MySQL Server component of Oracle MySQL, specifically in the Server: DDL subcomponent. It affects versions 5.5.58 and earlier, 5.6.38 and earlier, and 5.7.20 and earlier. The vulnerability allows low-privileged attackers with network access to exploit the MySQL Server, potentially leading to unauthorized denial of service (DoS) conditions. The CVSS 3.0 Base Score for this vulnerability is 6.5, indicating a significant impact on availability.
How To Fix
Minimum fixed version
10.1.32-r0
This is the first release that contains the fix.
sudo apk add --upgrade mariadbTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting network access to the MariaDB server to trusted IP addresses only, thereby limiting exposure to potential attackers.
Conclusion
CVE-2018-2622 poses a significant risk to MariaDB users, allowing for potential denial of service attacks. It is crucial to update to the patched version to mitigate this risk and ensure the stability of your database applications.
See every vulnerability recorded for mariadb →
FAQ
CVE-2018-2622 is a vulnerability in the MySQL Server component that allows low-privileged attackers to cause a denial of service.
The affected versions include MariaDB on Alpine Linux v3.4, v3.5, v3.6, and v3.7, specifically prior to version 10.1.32-r0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability can lead to a denial of service, causing the MySQL Server to hang or crash, which affects application availability.
If immediate updating is not possible, implement network restrictions to limit access to the MariaDB server as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for mariadb.
